Repository navigation
Socket Security GitHub App for nodejs/doc-kit #1105
Description
Hey folks 👋
I'd like to request the Socket Security GitHub App to be installed on nodejs/doc-kit, and only there for now.
Why
doc-kit's Dependabot PRs auto-merge after one code-owner approval, and our only dependency gate today is GitHub's Dependency Review, which only knows about published CVEs. Socket checks what a new or updated package actually does (install scripts, network/shell/filesystem access, obfuscated code, typosquats, maintainer changes, known malware) and reports it on the PR as a check run and a comment.
It also covers a gap our pnpm settings can't: about a third of doc-kit's runtime dependencies are published by a single npm account without provenance, so pnpm's trustPolicy has nothing to compare them against. We're tightening the rest of the setup in nodejs/doc-kit#1178.
Express, webpack and Electron already run it, and it's free for open source.
Permissions
| Scope | Permission |
|---|---|
| Repository | Checks: read & write |
| Repository | Contents: read & write (write is only for Socket's patch PRs, which we won't use) |
| Repository | Pull requests: read & write |
| Repository | Issues, Merge queues, Metadata: read |
| Organization | Members: read |
| Account | Email addresses: read |
We'd configure it through a socket.yml in the repo and make its PR check required once it has run.
REF
- https://docs.socket.dev/docs/permissions
- https://docs.socket.dev/docs/socket-for-github-installation
cc @nodejs/tsc @nodejs/web-infra
Activity
avivkeller commentedon Nov 2, 2026
I don't think we need socket in that repo, we review each changeset manually, and I think this'll add a lot of noise that a human reviewer will just avoid looking at?
ovflowd commentedon Nov 2, 2026
Socket is still useful and I rather have it even if as extra noise than accidentally being a Supply Chain victim.
MattIPv4 commentedon Nov 2, 2026
I relatively strongly disagree with this; introducing more bot noise to PRs is not a good thing. It just causes fatigue, and folks stop looking at the comments/PRs completely, instead just rubberstamping. I'd rather keep our PRs lean so that humans don't get tired of reviewing them.